Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

Filter by
Sorted by
Tagged with
0 votes
0 answers
3 views

Appending Data to LNK Shortcut File [Emotet TTP]

There has been a rise in the use of LNK shortcut files to deliver malware, in particular Emotet. Within the LNK file is a payload (usually a VBS script) that is found with findstr.exe. The payload is ...
0 votes
0 answers
4 views

Find/Remove suspected virus/malware on macbook air (mapi.sport80.com) [migrated]

I've found a program running on a friend's Mac that is under the name "mapi.sport80.com" in screen time & it has been running consistently for 5 days straight, it looks to be accessing ...
0 votes
5 answers
132 views

Are portable apps vulnerable to binary planting?

Several Windows apps come in both "installer" and "portable" forms, with the latter having the advantage that you can just download and run it from anywhere in the system. Doesn't ...
  • 105
0 votes
1 answer
50 views

Can malware override and execute any memory location or it has to be specific?

Rather primitive Malware using Python3 and similar already available software on the victim's machine (which can also be compiled using PyInstaller/pycom if not) has the capability to override the ...
0 votes
0 answers
42 views

malicious dll making GET & POST requests to legit sites. What could it be doing?

Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp ...
  • 1
0 votes
0 answers
29 views

Monitor Live Volatile Memory (RAM)

I am developing a project that involves extracting the contents of the RAM (volatile memory) of a computer to mitigate malware while is being executed. Currently, I do this by capturing the memory ...
  • 1
1 vote
0 answers
41 views

What would an android malware do with Direct Reply feature?

I'm reading this article: https://research.nccgroup.com/2022/09/06/sharkbot-is-back-in-google-play/ and quote: Besides this, the dropper has also removed the ‘Direct Reply’ feature, used to ...
  • 1,735
1 vote
1 answer
57 views

Can I trust companies that test antimalware software? [closed]

Do they lie? I mean companies something like AV-TEST, AV-Comparatives, Virus Bulleting, ERG Effitas, etc.
  • 11
1 vote
1 answer
42 views

Does connecting a virtual machine to a guest wifi connection protect the host machine from potential malware if it is connected to the main network?

I have a windows 10 host machine that is connected to my LAN with other devices. It runs a VMware Ubuntu virtual machine that is connected to the guest wifi and has shared folders between vm and host ...
  • 11
3 votes
2 answers
191 views

Can .ai files (Adobe Illustrator) be malicious?

They are blocked by our email gateway, but are also needed for some workflows. Can these files even contain malicious content and possibly execute code?
  • 61
0 votes
0 answers
3 views

Automatic BIOS Update - No logs confirm legitimacy [migrated]

As the title states. I rebooted my PC today and was greeted with a "BIOS is updating. Do not turn off or unplug from power." I have an Asus Sabertooh Z170 mark 1. The only Asus utility I ...
2 votes
2 answers
127 views

Could the USB-Receiver of a wireless mouse/keyboard be a security risk?

I bought a wireless keyboard and mouse from a no-name brand (made in China) with a USB receiver. I'm currently wondering if the USB receiver could be compromised in a way, that my computer could get ...
0 votes
1 answer
135 views

Windows Security deletes my USB virus as soon as I plug it in

I am studying ethical hacking and I work in the cybersecurity department of a company. I have been testing a hacking program but some PCs delete this executable as soon as I plug in the USB and some ...
  • 1
0 votes
0 answers
59 views

Same miner detection by Kaspersky Anti-Virus after every boot up

I recently bought and downloaded Kaspersky. Since I downloaded it, after every reboot, it keeps detecting what seems to be a crypto miner. Every time it claims to delete it. Should I be worried ? Name:...
0 votes
1 answer
61 views

Can ransomware impact SSD drives?

I was watching this DefCon talking about Solid State Drives (SSDs) destroying forensic and data recovery jobs. It was interesting to note, that the speaker did acknowledge that it is unknown how long ...
0 votes
2 answers
50 views

DomainFronting - re-routing and SSL certificats

I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting. Following hensonsecurity and zscaler blogs I have noticed that a detailed description regarding the re-...
1 vote
1 answer
82 views

Does using a Hyper-V Ubuntu VM add more security when web browsing?

I've always been concerned that my casual browsing of the web directly from Windows 10 could infect my PC. How much added security (if any) could be obtained by using Hyper-V to run an Ubuntu 22.04 ...
0 votes
0 answers
53 views

Suspicious incoming connection attempts from random IPv6 addresses on local network on macOS

I've been using Little Snitch on my Macbook and I have since a long time a rule to alert on any incoming IPv6 connection, which would be suspicious since I use IPv4 only. Since a couple of days I've ...
  • 101
0 votes
3 answers
195 views

Is it safe to use pirated software if AVs don't detect anything malicious about it?

I want to know whether it's safe to use a pirated software if during all of the processes including (downloading, running installer, installing, using and scanning installed files) the system's ...
's user avatar
0 votes
1 answer
65 views

Using PDF files from dubious sources

In one of my university courses, the lecture materials (solutions to homework assignments) are not fully supplied by the university itself, but have to be created by the students themselves: The ...
0 votes
0 answers
29 views

Does malware use Oracle RDBMS Kernel Executable (oracle.exe) to steal data?

I'm worried that my computer may have been infected by a virus. My Windows Virus Scan says that nothing came up, and a Chrome malware scan also turned up nothing. However, a process called Oracle ...
  • 103
1 vote
2 answers
122 views

Do standard USB chargers contain any OS or firmware that might be infected with malware?

I'd like to know if it is possible to figure out if the USB charger of my smartphone (more info below) contains any operating system or firmware which could be infected by malware. Let's assume I ...
0 votes
0 answers
16 views

Can a USB charger contain malware? [duplicate]

Today I charged my old smartphone (which is potentially infected with malware), using a standard USB charger. Afterwards, I used the same charger (and cable) to charge my new smartphone. The USB ...
2 votes
1 answer
87 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
1 vote
0 answers
76 views

Was the kernel I used vulnerable/deprecated?

Background Information As I developer I am running multiple (partly virtual-)machines with Debian GNU/Linux and on some of these machines I work with highly confidential documents or dangerous ...
  • 11
0 votes
2 answers
125 views

For someone who deals with dangerous files and websites frequently what is the way to avoid getting infected by spyware/virus permanently?

For someone who deals with dangerous files and websites frequently or even for the general user what is the way to avoid getting infected by spyware/virus permanently? I am looking to buy a new laptop ...
0 votes
1 answer
64 views

Malware file path

How is file location implying if a given file is possibly a malware or not? Example: Let's take windows wmiprvse.exe file. Web search results will often give you results similar to: "If this is ...
  • 3
0 votes
0 answers
25 views

How to get rid of TrustedStreams.life malware? [duplicate]

I have a Windows 11 PC, and several members of my family who aren't terribly savvy about what notifications they click "OK" on. Result: I now have some kind of malware called "...
  • 1,027
0 votes
1 answer
130 views

How malware file signature is generated?

How is the malware file signature generated? Does it use a sequence of bytes in the beginning, size, PE (export, import, section), etc? And can the MD5 or SHA256 be considered a file signature for a ...
  • 103
2 votes
3 answers
293 views

Can malware spread through HDMI, Display Port or USB

I have to give a presentation at my university. In the room where I'm going to give the presentation, there is a projector with a HDMI, Display Port, or USB connection. I will have to plug one of them ...
0 votes
1 answer
50 views

Boot virus on GPT?

I remember that some rare viruses can hide in MBR(it's 512bytes space). It's difficult to be detected and even if I reinstall operating system, the virus won't disappear. But how about it on the new ...
  • 1
0 votes
1 answer
83 views

What are the best security practices when when using VirtualBox on Windows 11 with an old OS?

Got a cheap new laptop to play old games with a VM of Windows XP/7, with the host being Windows 11. Using a WiFi that isn't my own (as I don't plan on connecting to the internet with this laptop) I ...
  • 1
1 vote
1 answer
115 views

Can an ISO file be harmful if opened as an archive?

I was trying to download something off a sketchy website, and ISO was a reasonable extension for what I was trying to get, but I was still pretty sure it was malicious. I didn't put much thought into ...
1 vote
0 answers
46 views

How to debug javascript code with Windows functions on Linux?

I am a beginner in analyzing javascript code on Linux and whenever the code is for a Windows machine I cannot proceed with debugging because there are undefined functions. Examples: GetObject(_6078(1),...
0 votes
1 answer
157 views

Why it's safe to use used RAM?

As we know, instructions are stored in RAM. So, can I embed a controller chip (or something like this) that can change the content of RAM? (e.g. change the Windows 10 boot instructions into malicious ...
  • 1
0 votes
1 answer
78 views

Strange Root CA certificate in Windows Trusted Root CA Store

While reviewing Root CA certificates in Windows Trusted Root CA Store I came across a stange Root CA certificate with Issuer Desktop-XXXXXXX and Subject Desktop-XXXXXXX, enhanced key usage for server ...
  • 1
0 votes
1 answer
93 views

No antiviruses scan graphics cards VRAM for malware?

As I know, for antiviruses the VRAM is a blindspot, so casual Windows users like me can't do much about it. They have an antivirus, which doesn't even search for malware in VRAM. What's the answer for ...
  • 19
0 votes
2 answers
143 views

Is it still possible to embed executables in PDF in 2022?

I have searched and found those posts how to embed exe file to pdf? and https://stackoverflow.com/questions/2941700/can-i-embed-an-exe-payload-in-a-pdf-doc-ppt-or-any-other-file-format, but they are ...
-1 votes
1 answer
95 views

Unknown localhost connections: Is this indication of continued compromise of device?

I have a stalker, and six months ago, he got my someone to evil maid my devices with a USB stick that person had borrowed (which then took me three months to discover). This attack appeared to have ...
0 votes
0 answers
27 views

Do I have to trust International Esim Providers?

I'm referring to international Esim providers like Keepgo and BNESIM. Those provide data only, i.e. you don't get a phone number and can't make calls/SMS (at least the options I'm interested in). ...
  • 33
0 votes
0 answers
46 views

Malware sinkhole evasion techniques

I have read into malware sink holing, as a way to disrupt botnets. There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
-1 votes
3 answers
102 views

Do some malware/viruses stay on the internet basically indefinitely?

Biological viruses stay in the population essentially indefinitely. We have immune systems, but this somehow doesn't cause virus strains to completely disappear after some time, as everyone's immune ...
2 votes
1 answer
527 views

Adguard adds adware like JavaScript code to each page render. What is it?

I'm using Firefox 101.0.1 with the extension AdGuard from the official Firefox add-ons page. When this extension is activated, I find strange adware like JavaScript code with the dev tools, evaluated ...
  • 175
0 votes
1 answer
135 views

How can malware remain on PC after I format my HDD? [duplicate]

How can a virus remain in the system after formatting the whole HDD? What are the ''types'' and how to remove them?
  • 1
0 votes
0 answers
44 views

How to fix deceptive site ahead warning on a wordpress site

I have an issue with my website, when visitors try to access it shows the deceptive site ahead warning I used google search console to try to fix it (as I successfully did it previously with some ...
  • 103
0 votes
2 answers
114 views

BadUSB and external USB peripherals - is using a USB device in a sandbox a risk?

I would like to ask about "BadUSB" vulnerability real world attack vectors. I got this idea, because I use virtual box as a sandbox for checking incoming files from clients (I am not an ...
  • 33
-1 votes
3 answers
200 views

What prevents Windows from being as secure as Linux? [duplicate]

According to wikipedia, Linux's security compared to Windows is generally due to "the malware's lack of root access." Why doesn't Windows just fix this?
32 votes
1 answer
5k views

Should I worry about compromised firmware when reinstalling an OS?

I have a machine that I suspect to be compromised and am installing a new OS from a usb. I know that there have been cases of malware surviving this, and even BIOS-reflashing, and something about the ...
  • 331
2 votes
2 answers
164 views

Suspicious "ChromeSync" pop-up in Android requesting credentials

Since late May, I have been getting suspicious pop-up messages overlay on top of android Apps (see screenshots), requesting entering of the "ChromeSync Passphrase" for my google account. I ...
0 votes
2 answers
180 views

Is it possible for a Windows virus to jump in partitions that are for ubuntu and are not visible in "This Pc"?

I installed Ubuntu on my computer a year ago (dual booting) but I created partitions that are exclusively for Ubuntu. This is how some Ubuntu partitions look on Disk Management. On Windows I have ...

1
2 3 4 5
49